Risk scores for entities

Patent metadata

Field	Value
Publication number	US-10878102-B2
Application number	US-201715596041-A
Country	US
Kind code	B2
Filing date	May 16, 2017
Priority date	May 16, 2017
Publication date	Dec 29, 2020
Grant date	Dec 29, 2020

Abstract

In some examples, a system receives anomaly scores regarding an entity from a plurality of detectors, produces a weighted anomaly score for the entity based on the anomaly scores and respective weights assigned to the plurality of detectors, the weights based on historical performance of the plurality of detectors, determines an impact based on a context of the entity, wherein the impact is indicative of an effect that the entity would have on a computing environment if the entity were to exhibit anomalous behavior, and computes a risk score for the entity based on the weighted anomaly score and the determined impact.

First claim

What is claimed is:

1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
generate anomaly scores regarding a first entity using a plurality of different types of detectors that apply different anomaly detection techniques, wherein the different anomaly detection techniques comprise a first type of anomaly detection technique based on features of a profile of the first entity and a second type of anomaly detection technique based on a graph representing interactions among entities including an access by the first entity of a program, the profile of the first entity comprising features representing accesses of programs by the first entity that change over time;
produce a weighted anomaly score for the first entity based on the anomaly scores and respective weights assigned to the plurality of different types of detectors, the respective weights based on an accuracy parameter and an efficiency parameter of the plurality of different types of detectors in performing past anomaly detections, the efficiency parameter representing an efficiency in usage of a processing resource by a respective detector of the plurality of different types of detectors;
determine an impact based on a context of the first entity, wherein the impact is indicative of an effect that the first entity would have on a computing environment when the first entity exhibits an anomalous behavior; and
compute a risk score for the first entity based on the weighted anomaly score and the determined impact.

2. The non-transitory machine-readable storage medium of claim 1 , wherein the impact is represented by a static impact score based on a static context of the first entity, wherein the static context comprises a static attribute that does not vary with a change in a setting of the first entity, and wherein the instructions upon execution cause the system to further:
determine a dynamic impact score based on a dynamic context of the first entity, the dynamic context comprising a dynamic attribute that changes with the change in the setting of the first entity, the dynamic attribute representing a number of users logged into the first entity,
wherein the risk score is based on the weighted anomaly score, the static impact score, and the dynamic impact score.

3. The non-transitory machine-readable storage medium of claim 2 , wherein the change in the setting comprises a change in time or a change in location.

4. The non-transitory machine-readable storage medium of claim 1 , wherein the accuracy parameter of the plurality of different types of detectors is based on production of false positives or false negatives by the plurality of different types of detectors in performing the past anomaly detections.

5. The non-transitory machine-readable storage medium of claim 1 , wherein a weight assigned to a first detector of the plurality of different types of detectors is proportional to an accuracy parameter of the first detector at a plurality of past time instances in performing past anomaly detections by the first detector.

6. The non-transitory machine-readable storage medium of claim 1 , wherein producing the weighted anomaly score for the first entity based on the anomaly scores and the respective weights assigned to the plurality of different types of detectors comprises computing a value derived from at least one selected from among: aggregating the respective weights and the generated anomaly scores, applying a classifier to weighted scores computed for the plurality of different types of detectors to obtain an aggregate score, selecting a maximum of the weighted scores, or computing a harmonic mean of the weighted scores.

7. A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
generate anomaly scores regarding a first entity using a plurality of different types of detectors that apply different anomaly detection techniques, wherein the different anomaly detection techniques comprise a first type of anomaly detection technique based on features of a profile of the first entity and a second type of anomaly detection technique based on a graph representing interactions among entities including an access by the first entity of a program, the profile of the first entity comprising features representing accesses of programs by the first entity that change over time;
produce a weighted anomaly score for the first entity based on the anomaly scores and respective weights assigned to the plurality of different types of detectors, the respective weights based on an accuracy parameter and an efficiency parameter of the plurality of different types of detectors in performing past anomaly detections, the efficiency parameter representing an efficiency in usage of a processing resource by a respective detector of the plurality of different types of detectors;
determine impact scores for respective static and dynamic contexts of the first entity, each impact score of the impact scores being indicative of an effect that the first entity would have on a computing environment when the first entity exhibits an anomalous behavior; and
compute a risk score for the first entity based on combining the weighted anomaly score and the impact scores.

8. The system of claim 7 , wherein the static context comprises a static attribute of the first entity that remains static for different settings of the first entity, and wherein the determined impact scores comprise a static impact score based on the static context.

9. The system of claim 8 , wherein the dynamic context comprises a dynamic attribute of the first entity that changes for the different settings of the first entity, the dynamic attribute representing a number of users logged into the first entity, wherein the determined impact scores comprise a dynamic impact score based on the dynamic context, and wherein the instructions are executable on the processor to compute the risk score based on combining the weighted anomaly score, the static impact score, and the dynamic impact score.

10. The system of claim 8 , wherein the dynamic context comprises dynamic attributes of the first entity that change for the different settings of the first entity, and wherein the determining of the impact scores for the dynamic context is based on impact scores assigned to the dynamic attributes by a domain expert or learned by a classifier based on historical data.

11. The system of claim 8 , wherein the dynamic context comprises dynamic attributes of the first entity that change for the different settings of the first entity, and wherein the determining of the impact scores for the dynamic context is based on impact scores and respective weights assigned to the dynamic attributes by a domain expert or learned by a classifier based on historical data.

12. The system of claim 9 , wherein the instructions are executable on the processor to:
combine the static impact score and the dynamic impact score to produce an overall impact score,
wherein the risk score for the first entity is based on the overall impact score.

13. The system of claim 12 , wherein the combining of the static impact score and the dynamic impact score comprises computing a weighted aggregate of the static impact score and the dynamic impact score.

14. The system of claim 7 , wherein the accuracy parameter of the plurality of different types of detectors is based on production of false positives or false negatives by the plurality of different types of detectors in performing the past anomaly detections.

15. A method comprising:
generating, by a

Assignees

• Entit Software Llc
• Micro Focus Llc

Inventors

• Manadhata Pratyusa K
• Marwah Manish
• Ulanov Alexander

Classifications

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title